Add ssh key and some fixes for constant password asking on remote end

README.md

@@ -29,6 +29,8 @@ Each local snapshot is named `move-YYYYMMDD-HHMMSS`.
 - The destination host needs ZFS utilities and the destination pool must exist.
 - The SSH account on the destination must be able to execute `sudo -n zfs`
   without a password prompt.
+- SSH must use a private key or SSH agent. Password authentication is disabled
+  by the script so a migration cannot pause and prompt once per dataset.
 - SSH connectivity and host-key verification must already work.
 
 The script is intended for one-shot full snapshot transfers. It does not use
@@ -55,6 +57,32 @@ bash zfs-move-over-ssh.sh \
   tank admin@new-server backup/tank
 ```
 
+## SSH Setup
+
+Create a dedicated key on the source server if one does not already exist:
+
+```bash
+ssh-keygen -t ed25519 -f ~/.ssh/zfs-migration -C zfs-migration
+```
+
+Install its public key for the remote account. This one command may ask for the
+remote account password during setup; the migration itself will not:
+
+```bash
+ssh-copy-id -i ~/.ssh/zfs-migration.pub admin@new-server
+```
+
+Verify that authentication and remote ZFS access work without either password:
+
+```bash
+ssh -i ~/.ssh/zfs-migration -o BatchMode=yes admin@new-server \
+  'sudo -n zfs list'
+```
+
+If this command fails, configure the remote account's `sudoers` entry for the
+necessary `zfs` commands with `NOPASSWD` before running the migration. Do not
+put a password in the script or on its command line.
+
 Options:
 
 | Option | Description |